[vulnerability][acl] ACL is skipped for class instances as source objects in Object.assign()

[t2ym]

[vulnerability][acl] ACL is skipped for class instances as source objects in Object.assign()

Root Cause

• Constructors of source objects are not checked for ACL
  • Fix for [vulnerability][acl] ACL is skipped for source objects in Object.assign() #324 covered only global objects and classes

Reproducible Code

window.Class = class Class {};
// This access must throw if acl.Class[S_PROTOTYPE][S_INSTANCE][S_ALL]: '---'
Object.assign({}, new Class());

Fix

• Check constructors of source objects as well as the object themselves